ci: qualify aggregate tests with pinned Compose available

Co-Authored-By: Codex <noreply@openai.com>

.circleci/config.yml

@@ -0,0 +1,14 @@
+version: 2.1
+setup: true
+orbs:
+  qqq-orb: kingsrook/qqq-orb@0.8
+workflows:
+  setup:
+    jobs:
+    - qqq-orb/generate_pipeline:
+        orb_version: '0.8'
+        filters:
+          branches:
+            ignore: automation/qbit-rc-pending
+          tags:
+            only: /.*/

.gitea/workflows/build.yaml

@@ -1,33 +0,0 @@
-name: build
-on:
-  push:
-jobs:
-  container:
-    uses: self:KofTwentyTwo/ci-workflows/.gitea/workflows/container.yaml@v1
-    secrets: inherit
-    with:
-      # Same gates as the old orb build-and-test + core smoke: script unit tests,
-      # the full reactor (BOM tests, packaged integration tests), then the packaged
-      # core jar smoked over HTTP. The Dockerfile copies that verified jar.
-      prebuild: |
-        set -euo pipefail
-        # The smoke scripts need Python 3 (stdlib only); the job image has none and no root for apt.
-        mkdir -p /tmp/python
-        curl -fsSLo /tmp/python.tgz https://github.com/astral-sh/python-build-standalone/releases/download/20261013/cpython-3.12.15%2B20261013-x86_64-unknown-linux-gnu-install_only.tar.gz
-        echo "5d546fc004fc2435fa142eb8f42ed8de5eb4725963dc22f7e6671014a80eb560  /tmp/python.tgz" | sha256sum -c -
-        tar -xzf /tmp/python.tgz -C /tmp/python --strip-components=1 && rm /tmp/python.tgz
-        # The release-bundle and full-smoke config tests render compose.yaml with `docker compose config`
-        # (no daemon). Provide the Compose binary behind a `docker compose`-only shim.
-        curl -fsSLo /tmp/python/bin/docker-compose https://github.com/docker/compose/releases/download/v5.6.1/docker-compose-linux-x86_64
-        echo "47737f4236e6d3ccea7291995203f8f018058783b4c3a9469119811a0b5db8c0  /tmp/python/bin/docker-compose" | sha256sum -c -
-        printf '%s\n' '#!/bin/sh' '[ "$1" = compose ] || { echo "only docker compose is installed" >&2; exit 1; }' 'shift' 'exec docker-compose "$@"' > /tmp/python/bin/docker
-        chmod +x /tmp/python/bin/docker-compose /tmp/python/bin/docker
-        export PATH=/tmp/python/bin:$PATH
-        python3 -m unittest discover -s scripts -p 'test_*.py' -v
-        mvn verify
-        python3 scripts/run_core_smoke.py qqq-all-app/target/qqq-all-app.jar
-      images: |
-        qqq-all|Dockerfile|.
-      # develop pushes git.kof22.com/qrun-io/qqq-all:ci-<sha>-run-<n> plus the moving develop tag.
-      publish-branch: develop
-      extra-tags: develop

.gitea/workflows/original-qualification.yaml

@@ -0,0 +1,14 @@
+# Actual original qqq-all reactor build, core HTTP smoke and full Compose HTTP smoke qualification (manual run).
+# A manual dispatch is not a push to develop, so the original `develop-image` job legitimately skips here; no image is
+# built or published, and no manual release is exercised.
+name: original-qualification
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  qualify:
+    uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/aggregate.yaml@b5eda78c467013c035747236a91f043ef0a90b45
+    with:
+      runner: linux-small
+      docker-runner: container-build

.github/workflows/release.yml

@@ -0,0 +1,53 @@
+name: Release 4.1.0
+'on':
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Reviewed source version (GA or exact coordinated RC)
+        required: true
+        type: choice
+        default: 4.1.0
+        options:
+        - 4.1.0
+        - 4.1.0-RC.1
+      release_sha:
+        description: Full develop commit SHA already signed and tagged with the selected
+          version
+        required: true
+        type: string
+      smoke_run_id:
+        description: Successful Smoke workflow run ID for that exact develop SHA
+        required: false
+        type: string
+        default: ''
+      smoke_evidence:
+        description: Evidence provider; github preserves the original Smoke workflow
+          validation
+        type: choice
+        default: circle
+        options:
+        - github
+        - circle
+        required: true
+      circle_workflow_id:
+        description: Exact successful Circle workflow UUID when circle evidence is
+          selected
+        type: string
+        required: false
+        default: ''
+permissions:
+  actions: read
+  contents: write
+  packages: write
+  checks: read
+jobs:
+  release:
+    uses: QRun-IO/qqq-orb/.github/workflows/qqq-all-release.yml@0f33ddadf88b9a1b940b8883782fe2000ee1d2bd
+    with:
+      version: ${{ inputs.version }}
+      release_sha: ${{ inputs.release_sha }}
+      smoke_run_id: ${{ inputs.smoke_run_id }}
+      smoke_evidence: ${{ inputs.smoke_evidence }}
+      circle_workflow_id: ${{ inputs.circle_workflow_id }}
+    secrets:
+      CIRCLECI_TOKEN: ${{ secrets.CIRCLECI_TOKEN }}

.qqq-ci.yml

@@ -0,0 +1,6 @@
+profile: all
+orb_version: '0.8'
+default_branch: develop
+publish:
+  snapshot: true
+publish_context: qqq-maven-registry-credentials

Dockerfile

@@ -1,7 +1,6 @@
 FROM eclipse-temurin:21-jre-jammy
 
 RUN apt-get update \
-    && apt-get upgrade -y --no-install-recommends \
     && apt-get install -y --no-install-recommends curl \
     && rm -rf /var/lib/apt/lists/* \
     && groupadd --system --gid 10001 qqq \

README.md

@@ -41,9 +41,9 @@ Full adds sample tables on PostgreSQL, MySQL, MongoDB, MinIO S3, and SFTP. It in
 
 To stop the full stack, run `docker compose --profile full down`. Add `--volumes` only when you intend to erase demo data. For a fresh Artemis volume, the configured login is required; old volumes created for anonymous access should be recreated. This reference stack uses demo credentials and is not a production deployment.
 
-CI runs [.gitea/workflows/build.yaml](.gitea/workflows/build.yaml) through the shared `KofTwentyTwo/ci-workflows` container workflow: script unit tests, `mvn verify`, and the packaged core HTTP smoke check on every push, then the image build and Trivy scan. Pushes to `develop` publish `git.kof22.com/qrun-io/qqq-all` (`ci-<sha>-run-<n>` and `develop`). The full Compose smoke check runs locally with `python3 scripts/run_full_smoke.py`.
+The [canonical QQQ pipeline](.circleci/config.yml), configured by [.qqq-ci.yml](.qqq-ci.yml), builds once and runs core/full smoke checks through the shared orb. Its develop-image job publishes to GHCR only after the container package exists and its visibility is public. Until then, image publication is skipped and local Compose remains available.
 
-The [4.1.0 release procedure](docs/release.md) describes the separate Maven parent/BOM publication path. The GitHub release workflow that called the retired qqq-orb was removed; a versioned release path on Gitea is not defined yet.
+The [4.1.0 release procedure](docs/release.md) describes the separate Maven parent/BOM publication path and the manually gated, exact-commit [release workflow](.github/workflows/release.yml). The workflow will not release the current snapshot build.
 
 ## Contributing and license
 

docs/release.md

@@ -1,6 +1,6 @@
 # 4.1.0 release preparation
 
-This procedure prepares a release; this repository currently remains on `4.1.0-SNAPSHOT`. The GitHub manual release workflow (GHCR image plus Compose bundle, via the retired qqq-orb) was removed with the move to Gitea CI; `develop` images now publish to `git.kof22.com/qrun-io/qqq-all`. A versioned release path on Gitea is not defined yet.
+This procedure prepares a release; this repository currently remains on `4.1.0-SNAPSHOT`. The [manual release workflow](../.github/workflows/release.yml) publishes the versioned GHCR image and a GitHub release containing an image-based Compose bundle plus `compose.yaml`. It does **not** deploy Maven artifacts or create a tag. Publication is authorized once the release gates pass. Keep the workflow disabled until Apache-2.0 alignment, public artifact verification and GHCR visibility are complete.
 
 ## Exact coordinated RC under QQQ #921
 

scripts/test_smoke.py

@@ -148,11 +148,11 @@ class SmokeTest(unittest.TestCase):
         pom = ET.parse(ROOT / "qqq-all-app" / "pom.xml")
         final_name = pom.findtext(".//{http://maven.apache.org/POM/4.0.0}build/"
                                   "{http://maven.apache.org/POM/4.0.0}finalName")
-        # CI smokes the exact jar Maven builds; keep the build output and the
-        # CI smoke command on the same artifact path.
+        # The shared all profile owns the smoke command; this repository owns
+        # the Maven artifact it consumes. Keep that cross-repository contract.
         self.assertEqual("qqq-all-app", final_name)
-        workflow = (ROOT / ".gitea" / "workflows" / "build.yaml").read_text()
-        self.assertIn("python3 scripts/run_core_smoke.py qqq-all-app/target/qqq-all-app.jar", workflow)
+        manifest = (ROOT / ".qqq-ci.yml").read_text()
+        self.assertRegex(manifest, r"(?m)^profile: all$")
 
 
     def test_standalone_full_smoke_requires_explicit_search_endpoint(self):